Signature Detail

IMAP: SUBSCRIBE Command Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Atrium Software's Mercur IMAP Server. Versions 5.00.14 SP4 and prior are vulnerable. IPSwitch IMail Server is also vulnerable. Attackers can perform a buffer overflow in the IMAP server allowing remote code execution.

Extended Description

Mercur IMAP is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. Currently, few technical details are available. This BID will be updated as more information becomes available. This issue may be related to BID 7842 (Atrium Software Mercur Mailserver IMAP Remote Buffer Overflow Vulnerability). An attacker may exploit this issue to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely result in denial-of-service conditions.

Affected Products

• Atrium Software Mercur IMAP
• Atrium Software MERCUR Messaging 2005 Service Pack 4
• Atrium Software MERCUR Messaging 2005 Enterprise Edition 5.0 SP3
• Atrium Software MERCUR Messaging 2005 Lite Edition 5.0 SP3
• Atrium Software MERCUR Messaging 2005 Standard Edition 5.0 SP3

References

• BugTraq: 23050
• CVE: CVE-2007-1579
• CVE: CVE-2007-2795
• URL: http://www.securityfocus.com/bid/23050
• URL: http://www.frsirt.com/english/advisories/2007/1092